Description

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check, and ActionPost::conditions_logic() short-circuiting its current_user_can('edit_post') authorization gate whenever the post ID is non-numeric — such as the string user_1 — allowing unauthenticated form submissions to be routed to arbitrary user records without restriction. This makes it possible for unauthenticated attackers to overwrite any user's registered email address, including an administrator's, and then leverage WordPress's native password-reset flow to fully take over the targeted account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-06T03:17:16.607Z",
  "pubdate": "2026-09-06T03:17:16.607Z",
  "executiveSummary": "The Frontend Admin plugin for WordPress, in versions up to and including 3.29.12, contains a critical authentication bypass vulnerability leading to full account takeover.\nThe vulnerability is categorized as an improper authorization flaw, specifically stemming from inadequate access control checks within the plugin's submission processing logic.\nAn unauthenticated attacker can exploit this flaw to overwrite the email address associated with any user account, including those with administrative privileges.\nOnce the target account's email is modified, the attacker can trigger the native WordPress password reset functionality to gain unauthorized access to the victim's account.\nThis vulnerability poses a severe risk to WordPress installations, as it facilitates complete site compromise through elevated privilege acquisition.\nExploitation does not require prior authentication or elevated privileges, making it highly accessible to external threat actors targeting vulnerable WordPress environments.\nThe primary risk implication is a total loss of site integrity, confidentiality, and availability if an administrative account is targeted.",
  "technicalDetails": "The vulnerability originates within the Frontend Admin plugin's form submission handling mechanisms, specifically involving the 'pre_update_value' function and the 'ActionPost::conditions_logic()' method.\nThe root cause is a failure to enforce mandatory capability or ownership verification during the form submission update process. The logic within 'ActionPost::conditions_logic()' is designed to perform an authorization gate check via 'current_user_can('edit_post')'.\nHowever, the implementation of this gate is flawed: the function short-circuits and fails to validate authorization whenever the post ID provided is non-numeric, such as the string 'user_1'.\nBy supplying a non-numeric string, an unauthenticated attacker bypasses the security check entirely, allowing the 'pre_update_value' function to execute without verification.\nThe attack flow proceeds as follows: First, the attacker identifies a form managed by the Frontend Admin plugin. Second, the attacker crafts a malicious POST request targeting the plugin's submission endpoint. Third, the attacker provides a manipulated 'post_id' parameter, such as 'user_1', which triggers the logic flaw in 'ActionPost::conditions_logic()'.\nFourth, the attacker includes payload data within the request that targets the 'user_email' field for the account they wish to compromise. Because the authorization gate is bypassed, the plugin proceeds to update the database with the attacker-controlled email address.\nFinally, once the user record is updated, the attacker initiates the standard WordPress 'wp-login.php?action=lostpassword' procedure for the targeted account. The password reset email is sent to the attacker-controlled address, allowing them to reset the password and seize control of the account.\nThis vulnerability is present in all versions up to and including 3.29.12. The scope of the attack is global, as any user record within the WordPress database can be modified. The exposure is network-based, requiring only the ability to submit a request to the WordPress site's frontend form endpoint. Post-exploitation impact is catastrophic, leading to immediate account takeover and subsequent persistent access, potential lateral movement, and complete administrative control over the underlying WordPress installation."
}